@otakit/capacitor-updater 2.3.1 → 2.3.3

package/Package.swift

@@ -22,6 +22,13 @@ let package = Package(
                 .product(name: "ZIPFoundation", package: "ZIPFoundation")
             ],
             path: "ios/Sources/UpdaterPlugin",
-            exclude: ["UpdaterPlugin.m"])
+            exclude: ["UpdaterPlugin.m"]),
+        .testTarget(
+            name: "UpdaterPluginTests",
+            dependencies: [
+                "UpdaterPlugin",
+                .product(name: "ZIPFoundation", package: "ZIPFoundation")
+            ],
+            path: "ios/Tests/UpdaterPluginTests")
     ]
 )

package/android/src/main/java/com/otakit/updater/UpdaterPlugin.java

@@ -319,7 +319,7 @@ public class UpdaterPlugin extends Plugin {
         if (hasStagedBundle) {
           resolveCurrentRuntimeKey();
           try {
-            if (!applyStaged(false)) {
+            if (!applyStaged()) {
               android.util.Log.w(
                 "OtaKit",
                 "Failed to apply a valid staged bundle during runtime handling"
@@ -334,7 +334,7 @@ public class UpdaterPlugin extends Plugin {
           DownloadResolution result = downloadLatest(false, null);
           resolveCurrentRuntimeKey();
           if (result.isForcedStaged()) {
-            requireApplyStaged(true);
+            requireApplyStaged();
           }
         });
         return;
@@ -343,7 +343,7 @@ public class UpdaterPlugin extends Plugin {
           DownloadResolution result = downloadLatest(false, null);
           resolveCurrentRuntimeKey();
           if (result.isForcedStaged()) {
-            requireApplyStaged(true);
+            requireApplyStaged();
           }
         });
         return;
@@ -355,7 +355,7 @@ public class UpdaterPlugin extends Plugin {
             return;
           }
           resolveCurrentRuntimeKey();
-          requireApplyStaged(true);
+          requireApplyStaged();
         });
         return;
     }
@@ -367,7 +367,7 @@ public class UpdaterPlugin extends Plugin {
         return;
       case APPLY_STAGED:
         try {
-          if (applyStaged(false)) {
+          if (applyStaged()) {
             return;
           }
         } catch (Exception e) {
@@ -377,7 +377,7 @@ public class UpdaterPlugin extends Plugin {
         executeAutomaticUpdate("launch apply-staged fallback", () -> {
           DownloadResolution result = downloadLatest(false, null);
           if (result.isForcedStaged()) {
-            requireApplyStaged(true);
+            requireApplyStaged();
           }
         });
         return;
@@ -385,7 +385,7 @@ public class UpdaterPlugin extends Plugin {
         executeAutomaticUpdate("launch shadow", () -> {
           DownloadResolution result = downloadLatest(false, null);
           if (result.isForcedStaged()) {
-            requireApplyStaged(true);
+            requireApplyStaged();
           }
         });
         return;
@@ -393,7 +393,7 @@ public class UpdaterPlugin extends Plugin {
         executeAutomaticUpdate("launch immediate", () -> {
           DownloadResolution result = downloadLatest(false, null);
           if ("staged".equals(result.kind)) {
-            requireApplyStaged(true);
+            requireApplyStaged();
           }
         });
         return;
@@ -406,12 +406,12 @@ public class UpdaterPlugin extends Plugin {
         return;
       case APPLY_STAGED:
         executeAutomaticUpdate("resume apply-staged", () -> {
-          if (applyStaged(true)) {
+          if (applyStaged()) {
             return;
           }
           DownloadResolution result = downloadLatest(true, null);
           if (result.isForcedStaged()) {
-            requireApplyStaged(true);
+            requireApplyStaged();
           }
         });
         return;
@@ -419,7 +419,7 @@ public class UpdaterPlugin extends Plugin {
         executeAutomaticUpdate("resume shadow", () -> {
           DownloadResolution result = downloadLatest(true, null);
           if (result.isForcedStaged()) {
-            requireApplyStaged(true);
+            requireApplyStaged();
           }
         });
         return;
@@ -427,7 +427,7 @@ public class UpdaterPlugin extends Plugin {
         executeAutomaticUpdate("resume immediate", () -> {
           DownloadResolution result = downloadLatest(false, null);
           if ("staged".equals(result.kind)) {
-            requireApplyStaged(true);
+            requireApplyStaged();
           }
         });
         return;
@@ -539,7 +539,7 @@ public class UpdaterPlugin extends Plugin {
     }
     executor.execute(() -> {
       try {
-        requireApplyStaged(true);
+        requireApplyStaged();
       } catch (Exception e) {
         call.reject("apply failed: " + e.getMessage());
       } finally {
@@ -558,7 +558,7 @@ public class UpdaterPlugin extends Plugin {
       try {
         DownloadResolution result = downloadLatest(false, null);
         if ("staged".equals(result.kind)) {
-          requireApplyStaged(true);
+          requireApplyStaged();
           return;
         }
         call.resolve();
@@ -983,7 +983,7 @@ public class UpdaterPlugin extends Plugin {
     throw new IllegalStateException("Bundle archive does not contain index.html");
   }
 
-  private boolean applyStaged(boolean reloadAfterApply) throws Exception {
+  private boolean applyStaged() throws Exception {
     UpdaterCoordinator.ApplyPreparation preparation = coordinator.prepareApplyStaged(
       this::isCompatibleRuntime,
       this::isBundleUsable
@@ -994,9 +994,6 @@ public class UpdaterPlugin extends Plugin {
     }
 
     applyServerBasePathSynchronously(preparation.activationPath);
-    if (reloadAfterApply) {
-      reloadWebViewSynchronously();
-    }
 
     cancelTrialTimeout();
     if (preparation.trialBundleId != null) {
@@ -1005,8 +1002,8 @@ public class UpdaterPlugin extends Plugin {
     return true;
   }
 
-  private void requireApplyStaged(boolean reloadAfterApply) throws Exception {
-    if (!applyStaged(reloadAfterApply)) {
+  private void requireApplyStaged() throws Exception {
+    if (!applyStaged()) {
       throw new IllegalStateException("Expected a staged bundle to be ready for apply");
     }
   }
@@ -1015,7 +1012,7 @@ public class UpdaterPlugin extends Plugin {
     cancelTrialTimeout();
     trialTimeoutRunnable = () -> {
       if (coordinator.isCurrentTrialBundle(bundleId)) {
-        rollbackCurrentBundle("notify_timeout", true);
+        rollbackCurrentBundle("notify_timeout");
       }
     };
     mainHandler.postDelayed(trialTimeoutRunnable, appReadyTimeoutMs);
@@ -1028,7 +1025,7 @@ public class UpdaterPlugin extends Plugin {
     }
   }
 
-  private void rollbackCurrentBundle(String reason, boolean shouldReload) {
+  private void rollbackCurrentBundle(String reason) {
     cancelTrialTimeout();
     UpdaterCoordinator.RollbackPreparation preparation = coordinator.prepareRollback(
       reason,
@@ -1056,9 +1053,6 @@ public class UpdaterPlugin extends Plugin {
 
     try {
       applyServerBasePathSynchronously(preparation.activationPath);
-      if (shouldReload) {
-        reloadWebViewSynchronously();
-      }
     } catch (Exception e) {
       android.util.Log.w("OtaKit", "rollback activation failed", e);
     }
@@ -1069,20 +1063,12 @@ public class UpdaterPlugin extends Plugin {
       if (bridge == null) {
         throw new IllegalStateException("Bridge not available for activation");
       }
-      if (path == null || path.isEmpty()) {
-        bridge.setServerAssetPath(BUILTIN_ASSET_PATH);
-      } else {
-        bridge.setServerBasePath(path);
-      }
-    });
-  }
-
-  private void reloadWebViewSynchronously() throws Exception {
-    runOnMainSynchronously(() -> {
-      if (bridge == null || bridge.getWebView() == null) {
-        throw new IllegalStateException("WebView not available for reload");
-      }
-      bridge.getWebView().reload();
+      WebViewActivation.activate(
+        path,
+        BUILTIN_ASSET_PATH,
+        bridge::setServerBasePath,
+        bridge::setServerAssetPath
+      );
     });
   }
 

package/android/src/main/java/com/otakit/updater/WebViewActivation.java

@@ -0,0 +1,26 @@
+package com.otakit.updater;
+
+final class WebViewActivation {
+
+  @FunctionalInterface
+  interface PathActivator {
+    void activate(String path);
+  }
+
+  private WebViewActivation() {}
+
+  static void activate(
+    String path,
+    String builtinAssetPath,
+    PathActivator setServerBasePath,
+    PathActivator setServerAssetPath
+  ) {
+    // Capacitor's Android setters both switch the hosted files and enqueue the
+    // WebView navigation. Calling WebView.reload() as well causes two navigations.
+    if (path == null || path.isEmpty()) {
+      setServerAssetPath.activate(builtinAssetPath);
+    } else {
+      setServerBasePath.activate(path);
+    }
+  }
+}

package/android/src/main/java/com/otakit/updater/ZipUtils.java

@@ -24,7 +24,9 @@ final class ZipUtils {
       ZipEntry entry;
       while ((entry = zis.getNextEntry()) != null) {
         String name = entry.getName();
-        if (name.contains("..") || name.startsWith("/") || name.startsWith("\\")) {
+        if (
+          containsParentDirectoryComponent(name) || name.startsWith("/") || name.startsWith("\\")
+        ) {
           throw new SecurityException("Zip path traversal attempt: " + name);
         }
 
@@ -69,4 +71,13 @@ final class ZipUtils {
       }
     }
   }
+
+  static boolean containsParentDirectoryComponent(String path) {
+    for (String component : path.split("/", -1)) {
+      if (component.equals("..")) {
+        return true;
+      }
+    }
+    return false;
+  }
 }

package/ios/Sources/UpdaterPlugin/ZipUtils.swift

@@ -1,7 +1,7 @@
 import Foundation
 import ZIPFoundation
 
-enum ZipUtilsError: Error {
+enum ZipUtilsError: LocalizedError {
   case invalidZip
   case pathTraversal(String)
   case absolutePath(String)
@@ -9,6 +9,25 @@ enum ZipUtilsError: Error {
   case unsupportedEntry(String)
   case fileCountExceeded(Int)
   case totalSizeExceeded(UInt64)
+
+  var errorDescription: String? {
+    switch self {
+    case .invalidZip:
+      return "Downloaded bundle is not a readable ZIP archive"
+    case let .pathTraversal(path):
+      return "ZIP entry contains a parent-directory path component: \(path)"
+    case let .absolutePath(path):
+      return "ZIP entry uses an absolute path: \(path)"
+    case let .symlinkNotAllowed(path):
+      return "ZIP entry is a symbolic link: \(path)"
+    case let .unsupportedEntry(path):
+      return "ZIP entry has an unsupported type: \(path)"
+    case let .fileCountExceeded(count):
+      return "ZIP archive contains too many files: \(count)"
+    case let .totalSizeExceeded(size):
+      return "ZIP archive expands beyond the size limit: \(size) bytes"
+    }
+  }
 }
 
 final class ZipUtils {
@@ -16,51 +35,14 @@ final class ZipUtils {
   private let maxTotalSize: UInt64 = 500_000_000 // 500 MB
 
   func extractSecurely(zipURL: URL, to destination: URL) throws {
-    guard let archive = Archive(url: zipURL, accessMode: .read) else {
+    let archive: Archive
+    do {
+      archive = try Archive(url: zipURL, accessMode: .read, pathEncoding: nil)
+    } catch {
       throw ZipUtilsError.invalidZip
     }
 
-    let destinationPath = destination.standardizedFileURL.path
-    let destinationPrefix =
-      destinationPath.hasSuffix("/") ? destinationPath : "\(destinationPath)/"
-
-    var fileCount = 0
-    var totalSize: UInt64 = 0
-
-    for entry in archive {
-      if entry.path.hasPrefix("/") {
-        throw ZipUtilsError.absolutePath(entry.path)
-      }
-      if entry.path.contains("..") {
-        throw ZipUtilsError.pathTraversal(entry.path)
-      }
-      if entry.type == .symlink {
-        throw ZipUtilsError.symlinkNotAllowed(entry.path)
-      }
-      if entry.type != .directory && entry.type != .file {
-        throw ZipUtilsError.unsupportedEntry(entry.path)
-      }
-
-      let outputURL = destination
-        .appendingPathComponent(entry.path)
-        .standardizedFileURL
-      let outputPath = outputURL.path
-      if !(outputPath == destinationPath || outputPath.hasPrefix(destinationPrefix))
-      {
-        throw ZipUtilsError.pathTraversal(entry.path)
-      }
-
-      if entry.type == .file {
-        fileCount += 1
-        if fileCount > maxFiles {
-          throw ZipUtilsError.fileCountExceeded(fileCount)
-        }
-        totalSize += entry.uncompressedSize
-        if totalSize > maxTotalSize {
-          throw ZipUtilsError.totalSizeExceeded(totalSize)
-        }
-      }
-    }
+    try validateEntries(in: archive, destination: destination)
 
     try FileManager.default.createDirectory(
       at: destination,
@@ -87,4 +69,62 @@ final class ZipUtils {
       }
     }
   }
+
+  private func validateEntries(in archive: Archive, destination: URL) throws {
+    let destinationPath = destination.standardizedFileURL.path
+    let destinationPrefix =
+      destinationPath.hasSuffix("/") ? destinationPath : "\(destinationPath)/"
+    var fileCount = 0
+    var totalSize: UInt64 = 0
+
+    for entry in archive {
+      try validateEntry(
+        entry,
+        destination: destination,
+        destinationPath: destinationPath,
+        destinationPrefix: destinationPrefix
+      )
+      guard entry.type == .file else { continue }
+
+      fileCount += 1
+      if fileCount > maxFiles {
+        throw ZipUtilsError.fileCountExceeded(fileCount)
+      }
+      totalSize += entry.uncompressedSize
+      if totalSize > maxTotalSize {
+        throw ZipUtilsError.totalSizeExceeded(totalSize)
+      }
+    }
+  }
+
+  private func validateEntry(
+    _ entry: Entry,
+    destination: URL,
+    destinationPath: String,
+    destinationPrefix: String
+  ) throws {
+    if entry.path.hasPrefix("/") {
+      throw ZipUtilsError.absolutePath(entry.path)
+    }
+    if Self.containsParentDirectoryComponent(in: entry.path) {
+      throw ZipUtilsError.pathTraversal(entry.path)
+    }
+    if entry.type == .symlink {
+      throw ZipUtilsError.symlinkNotAllowed(entry.path)
+    }
+    if entry.type != .directory && entry.type != .file {
+      throw ZipUtilsError.unsupportedEntry(entry.path)
+    }
+
+    let outputPath = destination
+      .appendingPathComponent(entry.path)
+      .standardizedFileURL.path
+    if !(outputPath == destinationPath || outputPath.hasPrefix(destinationPrefix)) {
+      throw ZipUtilsError.pathTraversal(entry.path)
+    }
+  }
+
+  static func containsParentDirectoryComponent(in path: String) -> Bool {
+    path.split(separator: "/", omittingEmptySubsequences: false).contains("..")
+  }
 }

package/ios/Tests/UpdaterPluginTests/ZipUtilsTests.swift

@@ -0,0 +1,227 @@
+import Foundation
+import XCTest
+import ZIPFoundation
+@testable import UpdaterPlugin
+
+final class ZipUtilsTests: XCTestCase {
+  private struct EntrySpec {
+    let path: String
+    let type: Entry.EntryType
+    let data: Data
+
+    init(_ path: String, type: Entry.EntryType = .file, contents: String = "fixture") {
+      self.path = path
+      self.type = type
+      data = Data(contents.utf8)
+    }
+  }
+
+  private struct Fixture {
+    let root: URL
+    let archive: URL
+    let destination: URL
+
+    func cleanup() {
+      try? FileManager.default.removeItem(at: root)
+    }
+  }
+
+  func testExtractsYazlArchiveWithAdjacentDotsInsideFilename() throws {
+    // Generated by @otakit/cli's yazl 2.5.1 writer. Both entries use ZIP data
+    // descriptors, matching the archive shape reported in OtaKit issue #15.
+    let archiveData = try XCTUnwrap(Data(
+      base64Encoded: """
+        UEsDBBQACAgIAMSuG10AAAAAAAAAAAAAAAAKAAAAaW5kZXguaHRtbLNRTMlPLqksSFXI
+        KMnNsbMpySzJSbUrSi0oyrfRh3AAUEsHCFi8GEAgAAAAIwAAAFBLAwQUAAgICADE
+        rhtdAAAAAAAAAAAAAAAADgAAAHNhZmUuLmNodW5rLmpzS87PK87PSdXLyU/XUCpO
+        TEtV0gQAUEsHCJNQbzkVAAAAEwAAAFBLAQI/AxQACAgIAMSuG11YvBhAIAAAACMA
+        AAAKAAAAAAAAAAAAAACkgQAAAABpbmRleC5odG1sUEsBAj8DFAAICAgAxK4bXZNQ
+        bzkVAAAAEwAAAA4AAAAAAAAAAAAAAKSBWAAAAHNhZmUuLmNodW5rLmpzUEsFBgAA
+        AAACAAIAdAAAAKkAAAAAAA==
+        """,
+      options: .ignoreUnknownCharacters
+    ))
+    XCTAssertEqual(archiveData[6] & 0x08, 0x08, "Fixture must retain yazl's data descriptor flag")
+    let fixture = try makeFixture(archiveData: archiveData)
+    defer { fixture.cleanup() }
+
+    try ZipUtils().extractSecurely(zipURL: fixture.archive, to: fixture.destination)
+
+    XCTAssertEqual(
+      try String(
+        contentsOf: fixture.destination.appendingPathComponent("safe..chunk.js"),
+        encoding: .utf8
+      ),
+      "console.log(\"safe\")"
+    )
+    XCTAssertTrue(
+      FileManager.default.fileExists(
+        atPath: fixture.destination.appendingPathComponent("index.html").path
+      )
+    )
+  }
+
+  func testParentDirectoryCheckUsesPathComponentsNotSubstrings() {
+    let safePaths = [
+      "asset..js",
+      "...",
+      ".well-known/config.json",
+      "dir/..hidden/file.js",
+      "dir/name...js",
+      "dir/%2E%2E/file.js"
+    ]
+    for path in safePaths {
+      XCTAssertFalse(
+        ZipUtils.containsParentDirectoryComponent(in: path),
+        "Expected safe path: \(path)"
+      )
+    }
+
+    let unsafePaths = [
+      "..",
+      "../escape.js",
+      "dir/../escape.js",
+      "dir/..",
+      "/../escape.js",
+      "dir//../escape.js"
+    ]
+    for path in unsafePaths {
+      XCTAssertTrue(
+        ZipUtils.containsParentDirectoryComponent(in: path),
+        "Expected parent-directory path component: \(path)"
+      )
+    }
+  }
+
+  func testExtractsNestedUnicodeAndDotNamedFiles() throws {
+    let fixture = try makeFixture(entries: [
+      EntrySpec("index.html", contents: "home"),
+      EntrySpec("assets/.well-known/name...üñícode.js", contents: "payload"),
+      EntrySpec("assets/empty.txt", contents: "")
+    ])
+    defer { fixture.cleanup() }
+
+    try ZipUtils().extractSecurely(zipURL: fixture.archive, to: fixture.destination)
+
+    XCTAssertEqual(
+      try String(
+        contentsOf: fixture.destination
+          .appendingPathComponent("assets/.well-known/name...üñícode.js"),
+        encoding: .utf8
+      ),
+      "payload"
+    )
+    XCTAssertEqual(
+      try Data(contentsOf: fixture.destination.appendingPathComponent("assets/empty.txt")),
+      Data()
+    )
+  }
+
+  func testRejectsExactParentDirectorySegmentBeforeExtractingAnything() throws {
+    let fixture = try makeFixture(entries: [
+      EntrySpec("index.html", contents: "must not be written"),
+      EntrySpec("assets/../escape.js")
+    ])
+    defer { fixture.cleanup() }
+
+    XCTAssertThrowsError(
+      try ZipUtils().extractSecurely(zipURL: fixture.archive, to: fixture.destination)
+    ) { error in
+      guard case let ZipUtilsError.pathTraversal(path) = error else {
+        return XCTFail("Expected pathTraversal, got \(String(reflecting: error))")
+      }
+      XCTAssertEqual(path, "assets/../escape.js")
+      XCTAssertEqual(
+        error.localizedDescription,
+        "ZIP entry contains a parent-directory path component: assets/../escape.js"
+      )
+    }
+    XCTAssertFalse(FileManager.default.fileExists(atPath: fixture.destination.path))
+  }
+
+  func testRejectsAbsolutePathBeforeExtractingAnything() throws {
+    let fixture = try makeFixture(entries: [EntrySpec("/escape.js")])
+    defer { fixture.cleanup() }
+
+    XCTAssertThrowsError(
+      try ZipUtils().extractSecurely(zipURL: fixture.archive, to: fixture.destination)
+    ) { error in
+      guard case let ZipUtilsError.absolutePath(path) = error else {
+        return XCTFail("Expected absolutePath, got \(String(reflecting: error))")
+      }
+      XCTAssertEqual(path, "/escape.js")
+    }
+    XCTAssertFalse(FileManager.default.fileExists(atPath: fixture.destination.path))
+  }
+
+  func testRejectsSymbolicLinkBeforeExtractingAnything() throws {
+    let fixture = try makeFixture(entries: [
+      EntrySpec("index.html", contents: "must not be written"),
+      EntrySpec("link", type: .symlink, contents: "../outside")
+    ])
+    defer { fixture.cleanup() }
+
+    XCTAssertThrowsError(
+      try ZipUtils().extractSecurely(zipURL: fixture.archive, to: fixture.destination)
+    ) { error in
+      guard case let ZipUtilsError.symlinkNotAllowed(path) = error else {
+        return XCTFail("Expected symlinkNotAllowed, got \(String(reflecting: error))")
+      }
+      XCTAssertEqual(path, "link")
+    }
+    XCTAssertFalse(FileManager.default.fileExists(atPath: fixture.destination.path))
+  }
+
+  func testRejectsUnreadableArchiveWithClearError() throws {
+    let fixture = try makeFixture(archiveData: Data("not a zip".utf8))
+    defer { fixture.cleanup() }
+
+    XCTAssertThrowsError(
+      try ZipUtils().extractSecurely(zipURL: fixture.archive, to: fixture.destination)
+    ) { error in
+      guard case ZipUtilsError.invalidZip = error else {
+        return XCTFail("Expected invalidZip, got \(String(reflecting: error))")
+      }
+      XCTAssertEqual(
+        error.localizedDescription,
+        "Downloaded bundle is not a readable ZIP archive"
+      )
+    }
+    XCTAssertFalse(FileManager.default.fileExists(atPath: fixture.destination.path))
+  }
+
+  private func makeFixture(archiveData: Data) throws -> Fixture {
+    let fixture = try emptyFixture()
+    try archiveData.write(to: fixture.archive)
+    return fixture
+  }
+
+  private func makeFixture(entries: [EntrySpec]) throws -> Fixture {
+    let fixture = try emptyFixture()
+    let archive = try Archive(url: fixture.archive, accessMode: .create, pathEncoding: nil)
+    for entry in entries {
+      try archive.addEntry(
+        with: entry.path,
+        type: entry.type,
+        uncompressedSize: Int64(entry.data.count),
+        compressionMethod: entry.type == .file ? .deflate : .none
+      ) { position, size in
+        let lowerBound = Int(position)
+        let upperBound = min(lowerBound + size, entry.data.count)
+        return entry.data.subdata(in: lowerBound..<upperBound)
+      }
+    }
+    return fixture
+  }
+
+  private func emptyFixture() throws -> Fixture {
+    let root = FileManager.default.temporaryDirectory
+      .appendingPathComponent("otakit-zip-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    return Fixture(
+      root: root,
+      archive: root.appendingPathComponent("fixture.zip"),
+      destination: root.appendingPathComponent("extracted", isDirectory: true)
+    )
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otakit/capacitor-updater",
-  "version": "2.3.1",
+  "version": "2.3.3",
   "description": "Capacitor plugin for OTA updates",
   "main": "dist/plugin.cjs.js",
   "module": "dist/esm/index.js",